How long does a bank remember bad debt?

Willing2Learn

John_G_Jones wrote: »

Here’s a radical plan, realise that your actions have consequences, and accept this like the adult that you pretend to be.

I just want to clear up some facts:

• I am disabled and defaulted when I was in hospital and unable to manage my accounts.
• I settled the default one year later once I received insurance payment for my illness.
• I rang up NatWest asking them not to default me while I was in hospital and advised them that I would clear the balance once I received an insurance payout.
• I desperately wanted to honour my overdraft agreement and unsuccessfully asked NatWest to freeze the account.
• I am an adult and accept full responsibility for my actions.

eskbanker wrote: »

Have they provided that information in response to your SAR?...

No, I have received nothing to date. They have up to 90 days to comply with the request I think (from memory)...

IanManc

Willing2Learn wrote: »

The NatWest policy and the storage limitation GDPR principal would seem to suggest that data should only be retained for a finite period.

I don't agree that the policies and principles "would seem to suggest" what you say they do - I think that this is just your interpretation of them in a way which is favourable to your own opinion.

But even if they "would seem to suggest" what you think they do, then storing the names of people who they've decided never to do business with again would only be for a finite period, ending with the deaths of the people on the list.

eskbanker

Willing2Learn wrote: »

The NatWest policy and the storage limitation GDPR principal would seem to suggest that data should only be retained for a finite period.

The GDPR principle essentially means that they need to be able to justify their data retention periods by correlating them to declared purposes, so, if, hypothetically, NatWest declared in their policy that customer data for those defaulting on debts will be kept for n years, or even indefinitely, for a defined purpose then that would be compliant, albeit still open to challenge if a case can be made by a customer that the policy is inherently unreasonable.

Personally I don't think the caveats in their wording (as pointed out by EarthBoy) should allow them to conceal their practices, and feel that they should declare the purposes where they're known - yes, there will always be the need for a bit of wriggle room for completely unforeseeable circumstances but if (as alleged earlier in the thread) they have a policy of retaining defaulters' data indefinitely then they should declare this.

Willing2Learn wrote: »

eskbanker wrote: »

Have they provided that information in response to your SAR?

No, I have received nothing to date. They have up to 90 days to comply with the request I think (from memory)...

They have one month to respond to an SAR.

Where did you find the data retention policy that you quoted, is it in some Ts & Cs perhaps?

Willing2Learn

IanManc wrote: »

I don't agree that the policies and principles "would seem to suggest" what you say they do - I think that this is just your interpretation of them in a way which is favourable to your own opinion.

I don't agree with you. My interpretation is lawful and is something that I intend to prove to NatWest. Besides, I enjoy the challenge

Willing2Learn

eskbanker wrote: »

Where did you find the data retention policy that you quoted, is it in some Ts & Cs perhaps?

I found the policy document on the NatWest website. https://personal.natwest.com/content/dam/natwest_com/Global/Privacy%20policy/NW-privacy-notice.pdf

I only found it this morning and have not had a chance to read fully. I have only skimmed and scanned thus far

eskbanker

Willing2Learn wrote: »

I found the policy document on the NatWest website. https://personal.natwest.com/content/dam/natwest_com/Global/Privacy%20policy/NW-privacy-notice.pdf

I only found it this morning and have not had a chance to read fully. I have only skimmed and scanned thus far

I suspect that they'll rely on the extensive list of purposes defined in Schedule A to justify ongoing data retention for defaulters, and in particular within section C (Legitimate interests of the bank):

c) It is in our interest as a business to manage our risk and to determine what products and services we can offer and the terms of those products and services. It is also in our interest to protect our business by preventing financial crime. This may include processing your information to:
(i) carry out financial, credit and insurance risk assessments;
(ii) manage and take decisions about your accounts;
(iii) carry out checks (in addition to statutory requirements) on customers and potential customers, business partners and associated persons, including performing adverse media checks, screening against external databases and sanctions lists and establishing connections to politically exposed persons;
(iv) share data with credit reference, fraud prevention agencies and law enforcement agencies;
(v) trace debtors and recovering outstanding debt;
(vi) for risk reporting and risk management.

Table A clarifies that you can object to their processing but that they can challenge this:

You have a right to object to us processing your personal information (and to request us to restrict processing) for the purposes described in Section C of Schedule A – Purposes of Processing (below), unless we can demonstrate compelling and legitimate grounds for the processing, which may override your own interests, or where we need to process your information to investigate and protect us or others from legal claims.

EarthBoy

Willing2Learn wrote: »

My interpretation is lawful and is something that I intend to prove to NatWest. Besides, I enjoy the challenge

You'll probably have to take them to court then, because it's ultimately up to the courts to decide how the law is to be correctly interpreted and whether the bank's procedures comply with the law or not.

Anyway, you don't really care how long NatWest keep your details, you're just annoyed that you can't get a free £150 out of them. You're only guessing that they won't accept you as a customer because of your previous debt. They haven't actually said that's the reason, it's only because you can't think of anything else. If a bank declines your application they are under no obligation to explain why, so even in the unlikely event that you got them to change their policy and forget your previous debt, they could still refuse your custom.

eskbanker

EarthBoy wrote: »

You'll probably have to take them to court then, because it's ultimately up to the courts to decide how the law is to be correctly interpreted and whether the bank's procedures comply with the law or not.

It may not be necessary to go to court now that the ICO has greater enforcement powers: https://ico.org.uk/action-weve-taken/

However, as you rightly point out, any victory would probably be a Pyrrhic one in any case when there would still be no obligation on NatWest to accept an application....

IanManc

Willing2Learn wrote: »

I don't agree with you. My interpretation is lawful and is something that I intend to prove to NatWest. Besides, I enjoy the challenge

Of course you don't agree with me. The point of my posting was that I didn't agree with you, and I began it by saying "I don't agree"!

By the way, "my interpretation is lawful" is meaningless.

Willing2Learn

EarthBoy wrote: »

You'll probably have to take them to court then, because it's ultimately up to the courts to decide how the law is to be correctly interpreted and whether the bank's procedures comply with the law or not.

I definitely will not be going to court as that would be way too much effort. I just intend to use NatWest policy and potentially ICO enforcement (if I can find the necessary data to support my case).

Interestingly, I made an application to RBS for their £150 switch incentive. This time there was a credit search (none for NatWest). The application did not fail on internal checks. This could imply that RBS either has a different policy on data retention, or they have failed to adhere to their own policy.